Uploaded byPrime Infoserv
FireEye Solutions
The document summarizes FireEye's cybersecurity products and services. It discusses how the evolving threat landscape is dissolving security perimeters and creating skills shortages. It then outlines FireEye's network security, email security, endpoint security, and Helix security operations platform products. It also describes FireEye's threat intelligence, managed defense services, and Mandiant consulting services for incident response and strategic advisory work.
More Related Content
FireEye Solutions
- 1.
- 2. ©2018 FireEye |Private & Confidential The World Is Changing 2 Cloud adoption & interconnected devices are dissolving the perimeter Lack of security expertise creating a skills shortage Increasing number of endpoints creating huge volumes of data Rapid threat evolution creating complex and diverse threats
- 3. ©2018 FireEye |Private & Confidential Rapid Threat Evolution 3 Hacktavists Foreign Nations Criminals Competitors Insiders
- 4. ©2018 FireEye |Private & Confidential Email and Web Are Primary Vectors To Break In Source: 1Verizon2015Data BreachInvestigationsReport 90% of Attacks Initiated over Email and Web 23% of Recipients Open Phishing Messages, 11% Click on Attachments 70-90% of Malware Samples are Unique to an Organization E-MAIL ATTACHMENT E-MAIL LINK WEB DRIVE-BY DIRECT INSTALL DOWNLOAD BY MALWARE WEB DOWNLOAD REMOTE INJECTION 40% 37% 17% 4% 3% 2% 2% 4
- 5. ©2018 FireEye |Private & Confidential CYBER SECURITY JOURNEY 5 CAPABILITY DETECTION RESPONSE HUNTING NETWORK OPERATIONS CENTRE (NOC) DEVICE MGT NETWORK OPERATIONS CENTRE (NOC) C Y B E R S E C U R I T Y P R O G R A M M A T U R I T Y SECURITY OPERATIONS CENTRE (SOC) CYBER INCIDENT RESPONSE TEAM (CIRT) CYBER DEFENSE CENTER (CDC) MATURITY Anti-Virus Firewall IDS/IPS Incident Response Retainer NG Firewall SIEM SIEM Monitoring Advanced Threat Protection Threat Detection & Response Logs Analytics On-demand CIRT Services Response Capability Threat Intel & Data Analytics Network Forensics Incident Response Threat Intelligence Subscription APT Hunting
- 6. ©2018 FireEye |Private & Confidential 6 FireEye knows more about than anyone.
- 7. ©2018 FireEye |Private & Confidential We Are FireEye 7 16M sensors deployed globally 700 frontline cyber security experts 10M threat actor personas tracked 50,000 indicators published per month 2004 year founded $700M+ in annual revenue 6,300 customers in 60+ Countries 40%+ of the Forbes Global 2000 are FireEye customers
- 8. ©2018 FireEye |Private & Confidential FireEye Helix FireEye Ecosystem 8 Contextual Intelligence Alerts/Case Management Investigative Workbench Orchestration & Automation Central Management FireEye Network Security FireEye Email Security FireEye Endpoint Security 3rd Party Solutions FireEye Threat Analytics Advanced Intelligence Expertise On-Demand 3rd Party Apps Managed Defense Expertise Threat Intelligence Partner Services Community Marketplace Answers Research Tools Ideas Mandiant Services Strategic Advisory Technical Assessment Incident Response
- 9. ©2018 FireEye |Private & Confidential FireEye Network Security 9 Network Security at a Glance ◆Detects the undetectable by leveraging advanced threat technologies with threat intelligence that catches what other solutions miss ◆Includes SmartVision – machine learning and correlation engines designed to detect suspicious lateral (east-west) network traffic ◆Backed by Dynamic Threat Intelligence, giving automated protection gained from threats detected worldwide ◆Includes integrated IPS, support for Mac and Windows PCs ◆Available in multiple form-factors and for a range of deployment scenarios Providing unparalleled threat detection and protection against myriad of threats, including advanced and targeted attacks.
- 10. ©2018 FireEye |Private & Confidential Network Security Differentiators DETECT & PREVENT FLEXIBILITY & OPERATIONAL EFFICIENCYANALYZE & RESPOND Expert Monitoring Remote monitoring by experts to identify critical threats and augment security staff Enriched Threat Intel Strategic and operational insights on attackers, tools and tactics Execution Insights Indicators of execution to aid endpoint validation and remediation efforts Efficient Operations Multi-stage analysis with execution- and intelligence- indicators to limit false-alerts Flexible Deployment Cloud-enabled or on-premise; virtual or physical; integrated or distributed Deployment Simplicity No policy configuration overheads Inline blocking Stops the threat with inline blocking scaling to 8 Gbps FireEye Intelligence Highly curated indicators from IR engagements and millions of globally deployed sensors Broad Coverage Wide attack surface coverage with Windows, OSX, 140+ file types, thousands of OS/app/file-type permutations Multi-Stage Detection Multi-flow and multi-vector detection with evasion- resistant architecture Workflow integrations Pivot rapidly from detection to investigation and response
- 11. ©2018 FireEye |Private & Confidential FireEye Email Security 11 At a Glance ◆Detects and blocks spear phishing emails, credential harvesting and CEO Fraud / BEC attacks ◆High-fidelity detection, low false positive rate ◆Augments alerts with intelligence ◆Blocks threats others miss ◆Multi-vector correlation ◆Deployable on-premises, cloud and hybrid covering Windows and Apple Mac OS X Detects email-borne attacks from the first time they’re seen, and blocks the most dangerous cyber threats. Technology Intelligence Correlation FireEye Email Security
- 12. ©2018 FireEye |Private & Confidential FireEye Endpoint Security Solution at a Glance ◆ Ultimate endpoint security: integrated EDR + EPP ◆ Protects against known threats with antivirus ◆ Protects against malware and exploits with ExploitGuard ◆ Detects anomalous behavior with real-time IOC engine ◆ Provides advanced forensics and hunting tools used by Mandiant ◆ Deployable on premise, virtual, and cloud, covering Windows, Macintosh, and Linux An integrated endpoint solution, designed by frontline responders to detect what others miss and protect against known and unknown threats.
- 13. ©2018 FireEye |Private & Confidential FireEye Endpoint Solution – Single Agent for everything Known Malware Threats Unknown Malware Threats Post Exploitation Attacker Threats Prevention Response AV (Signature) NGAV (Non-Signature) EDR (IOC, Hunting) Malware Protection Engine Exploit Guard IOC Alerting Intel Integration Enterprise Search Live Response Triage Acquisition Data Acquisition Containment
- 14. ©2018 FireEye |Private & Confidential FireEye Helix 14 Security Operations Platform at a Glance ◆Combines Technology + Intelligence + Services ◆Integrates FireEye and 3rd-party solutions ◆Augments alerts with intelligence ◆Automates and accelerates response ◆Facilitates all SOC functions in a single interface Intelligence-led security operations platform that makes it simple to deliver advanced security to any organization.
- 15. FireEye Helix Security OperationsPlatform FireEye Helix is most closely aligned with the Security Orchestration, Automation and Response (SOAR) market
- 16. ©2018 FireEye |Private & Confidential ADVANCE SOC 3.0 PLATFORM (SIEM) Cloud Correlation and Analysis Orchestration and Automation Intelligence-driven Security Security Operations Analysis and Reporting Multiple Vendors – No Single Console for Security Management ✔ ✔ ✔ ✔ ✔ User Entity Behavior Analytics
- 17. ©2018 FireEye |Private & Confidential 7 Key Problem Statements, FireEye Addresses with Helix ◆Comprehensive log visibility: Traditional syslog collection + bro-engine-driven alert generation ◆Reduce operational overheads: Offer SIEM as a Service, SLA-driven infrastructure management ◆Correlation rule effectiveness: We manage rules on customer behalf based on our deep intel, solving one of their biggest headaches ◆Alert prioritization: Contextual intelligence, What, When & Why ◆Consistency of analyst investigation: Guided investigations or tips to help look for the right things, consistently ◆Response automation: Tackles another big headache of customers “what next?”, major value when FSO integrates with Helix natively ◆Proactive threat hunting: Single platform for reactive and proactive approach, UEBA capabilities
- 18. ©2018 FireEye |Private & Confidential Key Capabilities ▶ Investigative workbench: Facilitates all SOC functions including alert management, search, analysis, investigations and reporting from a single interface. ▶ Contextual intelligence: Infuses frontline intelligence and rules onto existing alert and event data for greater visibility into threat actors and their TTPs. ▶ Automation: Automates response with prebuilt playbooks created by frontline practitioners. ▶ Rules & Analytics: Discovers hidden patterns and anomalies in data from existing security investments. ▶ Case management: Allows security teams to collaborate, assign and monitor investigative process tasks. • Visibility into all threat vectors from a single pane of glass • Accelerated response to threats with automation and intelligence • Reduced operational costs through improved analyst efficiency
- 19. The PX-IA Seriesbroadens incident identification and contextualization while deepening impact quantification, thereby improving the quality of response and decreasing the time to fix Enterprise Forensics (Px) A enterprise forensics solution that significantly reduces the Mean-Time-To- Resolution (MTTR) of a cyber attack by delivering supporting evidence in the form of packets, metadata, and intelligence within minutes -- not days.
- 20. ©2018 FireEye |Private & Confidential Platform IA PX IPFIX • Central Search Across PXs and IAs • Fast Search up to Layer 7 • Flow and Layer 7 Records • Enhanced Visualization • API with pivot to any PX • PCAP • Fast Search up to L4 • API • Session Reconstruction
- 21. ©2018 FireEye |Private & Confidential FireEye Managed Defense ◆Varied set of knowledge-driven intelligence sources providing extensive insight into your adversaries ◆Proactive hunting & investigation for covert evidence of active or attempted compromise ◆Provides depth and context with answers, not alerts ◆On call experts with a full spectrum of response capabilities to match the scope of your incident Augment your security team and reduce risk with experienced analyst-driven hunting and detection techniques providing accelerated response Knowledge-driven analyst detection, investigation and response
- 22. ©2018 FireEye |Private & Confidential Mandiant Consulting Prevent, detect, & respond to advanced cyber-security events 12017 Fortune list ◆Trusted by organizations worldwide – Customers include 40% of Fortune 100 companies1 ◆14+ years responding to and remediating headline breaches ◆Mandiant DNA – Pioneers in sophisticated cyber incident response ◆Frontline adversary exposure enabling cutting-edge threat intelligence ◆Global workforce of over 300 consultants in 20+ countries ◆Most frequently named IR organization across media publications in 2017
- 23. ©2018 FireEye |Private & Confidential 23 FireEye iSIGHT Intelligence ◆Uniquely positioned to understand attackers with adversarial + victim-based + detection intelligence ◆Broad, complete insight into all adversarial motivations ◆Intelligence experts worldwide providing localized, first-hand knowledge of threat environments and actors ◆Comprehensive API to integrate and automate Empowering smarter decisions at all levels of the security team, iSIGHT Intelligence is forward looking, high fidelity, adversary-focused intelligence with actionable advice Versus threat feeds Providing Decision Advantage
- 24. ©2018 FireEye |Private & Confidential Fireeye in a Nutshell Anti-APT Cover Network/Web(NX), Email(EX & ETP), Endpoint(Hx) & File Content(Fx) Threat Vectors Threat Intel Provide Practitioner Level Threat Intelligence - iSight(Adversary Led), DTI(Telemetry), Mandiant(Victim Led) Incident Response Services Best of Breed Incident Response – Mandiant Services Enterprise Forensics Enable Hunting teams to perform threat hunting & Forensics – Network Forensics (PX) & EndpointP (Hx) Forensics Platform for Malware Forensics – AX series SOC Operations Helix, Next Gen Platform for Advanced Security Analytics iSight Threat Intelligence Faas -Threat Hunting & Managed Defense Service
- 25. ©2018 FireEye |Private & Confidential Key Learnings & FireEye Belief ◆ Breaches are inevitable ◆ The problem is the HACKER not the MALWARE ◆ It takes more than TECHNOLOGY alone to stop today’s advanced attacks ◆ DETECTION & PREVENTION are necessary but not sufficient ◆ You need the capability to ANALYZE and RESPOND to breaches – which requires EXPERTISE ◆ If you are focused only on PREVENTION, you are not looking for breaches, and you’re contributing to the 146 days of lag to detection
- 26. ©2018 FireEye |Private & Confidential A Few of Our 2017 Awards
- 27. ©2018 FireEye |Private & Confidential Our Customers EDUCATION GOVERNMENT FINANCIAL SERVICES
- 28. ©2018 FireEye |Private & Confidential Our Customers HEALTHCARE RETAIL ENERGY & MANUFACTURING SERVICES
- 29. ©2018 FireEye |Private & Confidential TECHNOLOGY Our Customers
- 30.
- 31. ©2018 FireEye |Private & Confidential PRIME INFOSERV LLP (AN ISO 9001:2015 AND 27001:2013 CERTIFIED ENTERPRISE) DL-124, 1st Floor, Salt Lake, Sector – II, Kolkata – 700091, India Phone : +91 33 4008 5677 Mobile : +91 98300 17040, +91 90624 67427 Email : smukherjee@primeinfoserv.com , info@primeinfoserv.com , sales@primeinfoserv.com Web : www.primeinfoserv.com Contact us through our Value Added Partner